Agent Hotel Booking

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:04 PM UTC
• Version: 1.0.2

Overview

This hotel-booking integration is mostly coherent, but it handles payment and partner API credentials with insufficient URL scoping.

Review before installing. Use only with a fixed or allowlisted HTTPS Brek API endpoint, validate payment setup links against documented Brek or payment-provider domains before showing them to users, and keep the partner API key narrowly scoped and rotated. The skill does not show hidden execution or local persistence beyond disclosed billing/idempotency stores.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/api-templates.md:44

Finding

Partner API Key Sent to an Unrestricted Runtime-Configured Destination

Content

View full analysis

Vulnerability Details

File Location: references/api-templates.md, lines 44-50
Vulnerability Type: Unrestricted credential destination
Risk Level: High

Complete Code Snippet:

ts

async function brekRequest(path: string, init?: RequestInit) {
  const response = await fetch(`${BREK_BASE_URL}${path}`, {
    ...init,
    headers: {
      'content-type': 'application/json',
      'x-partner-api-key': BREK_PARTNER_API_KEY,
      ...(init?.headers || {})
    }
  });

Technical Analysis

The transport wrapper automatically sends BREK_PARTNER_API_KEY to the origin specified by BREK_BASE_URL. Although transmitting a credential is necessary to authenticate to the Brek API, the Skill does not require validation of the URL's scheme, hostname, port, embedded credentials, or resolved network address.

Because BREK_BASE_URL is a required runtime value rather than a fixed or allowlisted Brek endpoint, anyone capable of influencing deployment configuration can redirect authenticated requests to an attacker-controlled destination. This exceeds the minimum network privilege needed for the declared integration.

The wrapper also does not define a redirect policy. Depending on the runtime's fetch behavior, redirects may create additional unintended network exposure. Furthermore, spreading init.headers after the default headers permits callers to override authentication and content-type headers. That is not the primary credential-disclosure path, but it weakens the wrapper's security invariants.

Attack Path

1. An attacker gains influence over the environment or runtime configuration supplying BREK_BASE_URL.
2. The attacker changes it to an HTTP or HTTPS server under their control.
3. A user invokes a normal hotel-search, booking, or payment-confirmation flow.
4. brekRequest constructs the destination from the attacker-controlled base URL.
5. The wrapper sends BREK_PARTNER_API_KEY an ...[truncated 884 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a fixed official Brek API origin in production instead of accepting an arbitrary runtime base URL.
2. If configurability is required, parse the value with a standard URL parser and enforce:
   • The https: scheme.
   • An exact allowlist of approved Brek hostnames.
   • The expected port.
   • No username or password in the URL.
   • No fragments or unexpected base paths.
   • Rejection of localhost, IP literals, private networks, link-local addresses, and cloud metadata addresses.
3. Resolve endpoint paths with new URL(path, approvedBaseUrl) and verify that the resulting origin remains identical to the approved origin.
4. Disable redirects or validate every redirect target before following it.
5. Prevent init.headers from overriding security-critical headers. Merge caller headers first, then set the validated authentication header explicitly.
6. Scope the API key to the minimum required tenant and API operations, rotate it periodically, and immediately rotate it after suspected exposure.
7. Ensure authorization headers, API-key headers, and request bodies containing sensitive identifiers are redacted from logs.
8. Add automated tests proving that unapproved schemes, hosts, ports, redirects, and private network destinations are rejected before credentials are attached.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/payment-and-billing.md:8

Finding

Unvalidated Payment Setup URL Presented as a Secure Portal

Content

View full analysis

Vulnerability Details

File Location: references/payment-and-billing.md, lines 8-11 and 22-28
Vulnerability Type: Unvalidated externally supplied payment URL
Risk Level: Medium

Complete Code Snippet:

markdown

Use this state machine:
1. Receive `status=payment_setup_required` with `artifacts.payment.setupUrl`.
2. Return setup URL to human user and ask them to complete setup in Brek portal.
3. Human completes card setup in portal (provider-hosted fields only).
4. User returns and confirms completion (for example, "done").

text

Payment setup is required before booking.
Please open this secure Brek portal link and complete card setup: <setupUrl>
After you finish, reply "done" and I will continue.

Technical Analysis

The Skill directs the agent to display an API-provided artifacts.payment.setupUrl and explicitly describe it as a secure Brek portal link. No requirement is stated to validate the URL's scheme, origin, port, user-information component, or redirect behavior before presenting it.

An external URL should not be treated as trusted merely because it appears in an API response. This is especially important because the API destination itself is runtime-configurable. A compromised service, misconfigured endpoint, intercepted response from an insecure destination, or attacker-controlled endpoint could return a phishing URL.

The flow correctly prohibits collecting raw PAN or CVV in chat and requires provider-hosted fields. However, those protections do not prevent users from entering payment data into a malicious site reached through an unvalidated setup URL.

Attack Path

1. An attacker compromises or impersonates the configured API service, or exploits the unrestricted BREK_BASE_URL configuration.
2. The malicious service returns status=payment_setup_required.
3. It supplies an attacker-controlled URL in artifacts.payment.setupUrl.
4. The agent inserts that U ...[truncated 735 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse every setupUrl before displaying it.
2. Require HTTPS and allow only exact, documented Brek or approved payment-provider origins.
3. Reject URLs containing embedded usernames or passwords, unexpected ports, IP-literal hosts, deceptive subdomains, or unsupported paths.
4. Do not follow redirects unless every redirect destination is independently validated against the same allowlist.
5. Display the validated hostname to the user and avoid describing a link as secure until validation succeeds.
6. If validation fails, stop the payment flow and instruct the user to access the payment portal through a known official entry point.
7. Bind setup URLs to the expected session, partner, and expiration where supported, and require short-lived, single-use setup tokens.
8. Add tests using malicious URL forms, including look-alike domains, user-information prefixes, non-HTTPS schemes, encoded hosts, and redirect chains.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.